---
title: "Comment by Furqan Ashraf on \"Why One Email Gateway Is Not Enough Against Business Email Compromise\" | Hashnode"
description: "\"DMARC does not stop them\" should be printed on every email admin's monitor. On actually doing the lookalike monitoring, since that's where teams tend to stall:"
url: "https://hashnode.com/posts/why-one-email-gateway-is-not-enough-against-business-email-compromise/6ad6b1f7187368478c529606/comment/6ae0528f85eb9be9d541188a"
---

[Discussion](https://hashnode.com/posts/why-one-email-gateway-is-not-enough-against-business-email-compromise/6ad6b1f7187368478c529606)

Comment [Why One Email Gateway Is Not Enough Against Business Email Compromise](https://hashnode.com/posts/why-one-email-gateway-is-not-enough-against-business-email-compromise/6ad6b1f7187368478c529606)

[Furqan Ashraf](https://hashnode.com/@jfreaks)

[Oct 27](https://hashnode.com/posts/why-one-email-gateway-is-not-enough-against-business-email-compromise/6ad6b1f7187368478c529606/comment/6ae0528f85eb9be9d541188a)

"DMARC does not stop them" should be printed on every email admin's monitor.

On actually doing the lookalike monitoring, since that's where teams tend to stall: dnstwist on a schedule against your own domain is a fine free start. Where it gets thin is homoglyph variants and brand-plus-keyword names like `yourbrand-support`, which are exactly what BEC crews use for executive impersonation.

If you'd rather not run that yourself, [WhoisFreaks Brand Monitoring](https://whoisfreaks.com/products/brand-monitoring) scans new registrations twice a day for typos, homoglyphs, keyword combos and TLD swaps, and alerts by email or webhook. Disclosure: I work there. There's a one-brand trial on request.

Either way, the output slots nicely into your week-two gateway review as the list behind "domains that look like your own."